Talk:Injection Prevention Cheat Sheet

Following questions to the wiki as from 6-apr-10

(items are the headlines in the wiki page):

• A2:

we read: "An already productive application (with MVC architecture) ..."

Q: why is this restricted to MVC? I don't see any reason for that as OpenSource applications must not be MVC.

• Query languages

we read: "The most famous form of injection is SQL Injection ..."

Hmm, SQL Injection is #1 in OWASP top 10 2010 now, but XSS is famous and popular as SQL Injection.

Q: why is XSS missing?

• OS calls

I'd use the term OS Commanding

Missing, somehow in wiki as from 6-apr-10

• Application Protocol

The application protocol, HTTP here, can also be injected. Think of %0d%0a injections in the URL. This may lead to all sorts of HRS (HTTP Response Splitting/Smuggling, HTTP Request Smuggling/Splitting). It may also lead to HTTP header injections for example setting cookies.

• File Include - RFI, LFI

Most web application frameworks support file inclusion, wether they are additional script code or some data. Improper data validation may lead to include program code or data from unexpected sources. Most common are vulneranilities in PHP. But SSI and even Java may be vulnerable.

• Format String

If unvalidated user data are used as input to formatting strings, for example in C/C++ functions like fprintf, printf, sprintf, ..., arbitrary code may be executed or software crashes.

• Null Byte Injection

This injection can alter intended application logic and allow malicious code injected. It can also be used to bypass sanity checks or filters in web applications or WAFS by adding URL-encoded null byte characters: %00.

• URL Redirector Abuse

Bug or feature? It's an injection vulnerability, somehow.

Not sure if it should be added.